projects / linux-block.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: b1db244) | patch
netfilter: nf_tables: do not allow mismatch field size and set key length
authorPablo Neira Ayuso <pablo@netfilter.org>
Sun, 14 Jan 2024 22:53:39 +0000 (23:53 +0100)
committerPablo Neira Ayuso <pablo@netfilter.org>
Wed, 17 Jan 2024 11:02:50 +0000 (12:02 +0100)
commit3ce67e3793f48c1b9635beb9bb71116ca1e51b58
tree3a484d2bb81d8b298a837928db751bc7a8646b05tree
parentb1db244ffd041a49ecc9618e8feb6b5c1afcdaa7commit | diff
netfilter: nf_tables: do not allow mismatch field size and set key length

The set description provides the size of each field in the set whose sum
should not mismatch the set key length, bail out otherwise.

I did not manage to crash nft_set_pipapo with mismatch fields and set key
length so far, but this is UB which must be disallowed.

Fixes: f3a2181e16f1 ("netfilter: nf_tables: Support for sets with multiple ranged fields")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
net/netfilter/nf_tables_api.c diff | blob | blame | history
Linux 6.x block layer and io_uring tree(s)